The following table outlines the complete parameter set for integrating LDAP with Console:

Debugging Common Errors

When running the application with verbose logging (-debug -log debug), you may encounter the following issues:

1. Invalid Credentials (Code 49)

LDAP Result Code 49 "Invalid Credentials": 80090308: LdapErr: DSID-0C0903D3...

This indicates an authentication failure during the binding phase or the login phase.

• Bind Configuration: Verify bind_user and bind_secret. Note that bind_user accepts two formats:
  1. Full Distinguished Name: cn=admin,ou=users,dc=example,dc=com
  2. User Principal Name (Recommended for Active Directory): admin@example.com
• Login Credentials: Ensure the end-user credentials attempting to log in are correct.

2. Filter Compilation Error (Code 201)

LDAP Result Code 201 "Filter Compile Error": ldap: finished compiling filter with extra at end

This suggests the search_filter syntax is invalid. The filter must be a valid LDAP query string containing %s to substitute the incoming username.

3. Authorization Failures (No Privilege)

authorize result: false, user: &{{test@domain.com...}, err: no privilege assigned to this user:test@domain.com

This occurs when role mapping fails. Check the configuration of id_field, group_field, and the corresponding role_map entries.

• Attribute Matching: Ensure id_field and group_field correspond to actual attributes existing on the LDAP user objects.
• Mapping Restrictions: Do not use the dot (.) character within the values defined in role_map.uid or role_map.group.

Configuration Example

Below is a Go snippet demonstrating how one might apply these settings programmatically:

package config

import "github.com/go-ldap/ldap/v3"

// LDAPSettings defines the structure for directory integration
type LDAPSettings struct {
	ServerAddr string
	Port      int
	EnableTLS bool
	BindDN    string
	BindPass  string
	BaseDN    string
	Filter    string
	IDKey     string
	GroupKey  string
}

func NewDirectoryConfig() *LDAPSettings {
	return &LDAPSettings{
		ServerAddr: "ldap.internal.local",
		Port:       389,
		BindDN:     "svc_reader@internal.local",
		BindPass:   "SecurePass123",
		BaseDN:     "dc=internal,dc=local",
		Filter:     "(mail=%s)",
		IDKey:      "sAMAccountName",
		GroupKey:   "memberOf",
	}
}